From: Paul Davey Date: Mon, 5 Nov 2018 05:09:29 +0000 (+1300) Subject: fs: ubifs: Fix UBIFS decompression on 64 bit X-Git-Tag: v2018.11~13^2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e4aa10ba5770fc391bf8a4b00c131353901704e7;p=platform%2Fkernel%2Fu-boot.git fs: ubifs: Fix UBIFS decompression on 64 bit Add local size_t variable to crypto_comp_decompress as intermediate storage for destination length to avoid memory corruption and incorrect results on 64 bit targets. This is what linux does for the various lz compression implementations. Signed-off-by: Paul Davey Cc: Heiko Schocher Tested-by: Heiko Schocher --- diff --git a/fs/ubifs/ubifs.c b/fs/ubifs/ubifs.c index 47fa41a..d5101d3 100644 --- a/fs/ubifs/ubifs.c +++ b/fs/ubifs/ubifs.c @@ -125,6 +125,7 @@ crypto_comp_decompress(const struct ubifs_info *c, struct crypto_comp *tfm, { struct ubifs_compressor *compr = ubifs_compressors[tfm->compressor]; int err; + size_t tmp_len = *dlen; if (compr->compr_type == UBIFS_COMPR_NONE) { memcpy(dst, src, slen); @@ -132,11 +133,12 @@ crypto_comp_decompress(const struct ubifs_info *c, struct crypto_comp *tfm, return 0; } - err = compr->decompress(src, slen, dst, (size_t *)dlen); + err = compr->decompress(src, slen, dst, &tmp_len); if (err) ubifs_err(c, "cannot decompress %d bytes, compressor %s, " "error %d", slen, compr->name, err); + *dlen = tmp_len; return err; return 0;